Add native DNS-over-TLS (DoT) on dot.nook.family:853

- ddclient.tf: dynamic DNS daemon that keeps dot.nook.family A record
  pointing at the home public IP via Cloudflare API (updates every 5m)
- adguard.tf: cert-manager Certificate for dot.nook.family via DNS-01,
  updated TLS config block with DoT paths and port 853
- apps/adguard.yaml: mount adguard-dot-tls secret, expose port 853,
  init container enforces TLS/DoT settings on every restart
- adguard.tf: fix stale neuralplatform.dev → neuralplatform.ai rewrite

Android Private DNS: set to dot.nook.family
Router: forward TCP 853 → 192.168.68.77

servers/legion/adguard.tf

@@ -1,4 +1,4 @@
-# AdGuard Home — household DNS with ad blocking, local resolution, and DoH via dns.nook.family
+# AdGuard Home — household DNS with ad blocking, local resolution, DoH via dns.nook.family, and DoT via dot.nook.family:853
 
 resource "kubernetes_namespace" "dns" {
   metadata {
@@ -89,6 +89,11 @@ resource "kubernetes_config_map" "adguard_defaults" {
           name: EasyPrivacy
           id: 5
       tls:
+        enabled: true
+        server_name: dot.nook.family
+        port_dns_over_tls: 853
+        certificate_path: /etc/adguard/tls/tls.crt
+        private_key_path: /etc/adguard/tls/tls.key
         allow_unencrypted_doh: true
       filtering:
         filtering_enabled: true
@@ -96,13 +101,35 @@ resource "kubernetes_config_map" "adguard_defaults" {
           - domain: '*.nook.family'
             answer: ${var.legion_ip}
             enabled: true
-          - domain: '*.neuralplatform.dev'
+          - domain: '*.neuralplatform.ai'
             answer: ${var.legion_ip}
             enabled: true
     EOT
   }
 }
 
+# TLS certificate for DoT — issued via cert-manager DNS-01 (Cloudflare)
+resource "kubernetes_manifest" "adguard_dot_cert" {
+  manifest = {
+    apiVersion = "cert-manager.io/v1"
+    kind       = "Certificate"
+    metadata = {
+      name      = "adguard-dot-tls"
+      namespace = kubernetes_namespace.dns.metadata[0].name
+    }
+    spec = {
+      secretName = "adguard-dot-tls"
+      issuerRef = {
+        name = "letsencrypt-prod"
+        kind = "ClusterIssuer"
+      }
+      dnsNames = ["dot.nook.family"]
+    }
+  }
+
+  depends_on = [kubernetes_manifest.cluster_issuer_prod]
+}
+
 # Deployment + Service managed by Argo CD — see servers/legion/apps/adguard.yaml
 
 resource "kubernetes_ingress_v1" "adguard" {